Solved: Re: How to edit my rex search to extract two diffe... - Splunk Community

Splunk Search

Current search:

search "xxx" | rex field=_raw "api:(?\s\d+.\d+.\d+.\d+)"

I'm using the rex command, but it does not return the expected result when there are two IP addresses.

1 Solution

Solution

If both IPs are in the same event with "api" before it, you can use max_match, like this

search "xxx" | rex max_match=0 field=_raw "api:\s?(?<IP>\d+.\d+.\d+.\d+)" | mvexpand IP | table IP

If they are not in the same event, will need to see some sample events.

http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Regex

View solution in original post

Solution

If both IPs are in the same event with "api" before it, you can use max_match, like this

search "xxx" | rex max_match=0 field=_raw "api:\s?(?<IP>\d+.\d+.\d+.\d+)" | mvexpand IP | table IP

If they are not in the same event, will need to see some sample events.

http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Regex

Please share some sample events.

---
If this reply helps you, Karma would be appreciated.

Get Updates on the Splunk Community!

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...